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Lacking case in CVSS 
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We need New Metrics 


e Using Complexity Risk 
- mod chip (Low) / other (High) 
e Productivity Risk 
- Hardware (Low) / Software (High) 
e Availability Risk 
- physical (Low) / Internet (High) 
e Legality Risk 
- illegality (Low) / gray (Middle) / legally 
(High) 
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CVSS > NVSS 
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= E User vs Attacker 


User == Attacker As 


use case 1 
ARM9 injection from website 
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Productivity Attacker == 
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Hacker 
Legality Attacker == 
Hacker 
Access Vector User == Remote 
Attacker 
Access Under 4.5 
Complexity firmware 
Authentication User == Needless 
Attacker 
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Complexity 
Confidentiality = - All 
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use case 2 
parental tool 
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Attacker == 
Hacker 
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Hacker 
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Software Metric 
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use case 3 
Gateway3DS 


JA case | 


Productivity Attacker == Existing 
Hacker hardware 

Availability Attacker == Physical 
Hacker 

Legality Attacker == gray 
Hacker 

Access Vector User == N/A 
Attacker 

Access Under 4.5 

Complexity firmware 

Authentication User == N/A 
Attacker 

Using Cartridge 

Complexity 

Confidentiality = - All 


Impact 


use case 4 
MSET vuln 
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Productivity Attacker == Hardware 
Hacker 

Availability Attacker == Physical 
Hacker 

Legality Attacker == Illegal 
Hacker 

Access Vector User == N/A 
Attacker 

Access Under 6.0 

Complexity firmware 

Authentication User == N/A 
Attacker 

Using Cartridge 

Complexity 

Confidentiality = - Part 


Impact 


use case 5 
Sandbox vuln 


JA case | 


Productivity Attacker == Hardware 
Hacker 

Availability Attacker == Physical 
Hacker 

Legality Attacker == 
Hacker 

Access Vector User == N/A 
Attacker 

Access Under 6.0 

Complexity firmware 

Authentication User == N/A 
Attacker 

Using Need entry 

Complexity point 

Confidentiality = - Part 


Impact 


use case 6 
process9 vuln 
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Productivity Attacker == Hardware 
Hacker 

Availability Attacker == Physical 
Hacker 

Legality Attacker == 
Hacker 

Access Vector User == N/A 
Attacker 

Access Under 6.0 

Complexity firmware 

Authentication User == N/A 
Attacker 

Using Need entry 

Complexity point 

Confidentiality = - All 


Impact 


